CVE-2023-35784: Double Free
A double free or use after free could occur after SSLclear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-35784?
CVE-2023-35784 is a vulnerability that allows for a double free or use after free after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3.
Which software versions are affected by CVE-2023-35784?
Openbsd Libressl versions up to 3.6.3 and Openbsd Libressl versions 3.7.0 to 3.7.3, as well as Openbsd Openbsd versions 7.2 and 7.3 are affected by CVE-2023-35784.
What is the severity of CVE-2023-35784?
CVE-2023-35784 has a severity rating of critical (9.8).
How do I fix CVE-2023-35784?
To fix CVE-2023-35784, users should update to OpenBSD 7.2 errata 026 or later, OpenBSD 7.3 errata 004 or later, LibreSSL 3.6.3 or later, or LibreSSL 3.7.3 or later.
Where can I find more information about CVE-2023-35784?
More information about CVE-2023-35784 can be found in the OpenBSD LibreSSL release notes for versions 3.6.3 and 3.7.3, as well as the OpenBSD patches for 7.2 errata 026.